AADSTS70043

What it means

The refresh token is invalid because of Conditional Access sign-in frequency.

How to fix it

Expected when the sign-in frequency is reached. The user signs in again.

How to investigate

1. Compare what the app sends (client ID, redirect URI, scopes, tenant) with the app registration.
2. Decode the token or request: the JWT and SAML decoders on this site show exactly what was sent.
3. Check the app's credentials (secrets and certificates) and whether the service principal exists and is enabled in this tenant.
4. Search the sign-in logs for the request ID or correlation ID from the troubleshooting details on the error page.

Guides on this site

• Configurable token lifetimes are GA: when to shorten them (and when not to)

Tools that help

• JWT decoder
• GUID lookup
• Microsoft's error lookup for 70043 ↗